
Mr. Steven Garfinkel 
Director, Information Security 
Oversight Office 
General Services Administration 
18th § F Streets, N.W. 

Room 6040 

Washington, D.C. 20405 
Dear Steve : 

The survey questions you forwarded to me concerning your study on the 
use of automated data processing equipment (ADP) systems in information 
security systems have been answered and are enclosed herewith. Since this 
was a preliminary survey, I did not require detailed responses from the 
components providing information since to gather precise information would 
have been a rather lengthy process. 

If additional information is required, we shall be happy to assist in 
any way. 

Sincerely, 

/*/ THoms H. White 

Thomas H. White 

Director of Information Services 
Directorate of Administration 
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USE OF ADP EQUIPMENT/SYSTEMS * 
IN INFORMATION SECURITY PROGRAMS 


AGENCY; Central Intelligence Agency 

ACTIVITY, OFFICE, DIVISION: officc of Information Services, PDA 

NAME AND TITLE OF RESPONDER: Thomas H. White, Director of Inform ation Services 


DATE: 31 March 1981 


♦NOTE : FOR THE PURPOSE OF THIS STUDY, ADP EQUIPMENT/SYSTEMS DOES NOT INCLUDE WORD 
PROCESSING EQUIPMENT. 
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1. When did you start using AOP computer 

equipment in the managemeilt of your • 

information security program?. 1975 


2. How did you determine the need for 
computerization in your information 

security program? Too much data for manual methods. 


> 


3. Did you have any difficulties in 
getting authorization for use of 

computer systems? What were the Getting our people trained in the use of this 

major difficulties? equipment and keeping these skills current was 

(and is) our biggest concern. 
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4. What aspects of the information security 

program are being supported by ADP systems? . ' , ’ 

(Brief explanation) 

a. Control system for accountable classified material? 

b. Inventories? Top Secret? Secret? Confidential? 

c. Personnel security clearances? 

d. Control of passes? 

e. Mandatory review for declassification? 

f. Systematic review for declassification? 

g. Other declassification programs? 

h. FOIA requests involving classified information 

i. Other ( specify )_ , 

a, b, c, d, e, £, and h. 

| Our system for accounting and controlling Top Secret Agency documents generates via Batch mode, inventory 
listings for each of our user offices or control points. Our system does have on-line input/edit features. 
We then review these inventories with individual offices and later conduct audits of same. 

Our other systems for personnel clearances, control of "identification” documents, mandatory and systematic 
review and FOIA requests are "store and retrieval" systems. 


5. Are reports generated as a result of ADP processing? Yes, exception reports taken from 

What kinds? Are they used by other agencies? (If so, SMF audit trail information. Not 

explain.) How frequently are they updated? used by other agencies. Reports 

generated weekly. 

A Reports for mandatory and systematic review are generated and updated on an as needed basis. Some systematic 
| review reports are used by other agencies to determine What the review decision was so they could properly handle 
our documents in their possession. . _____ - 


6. Has the use of ADP systems in your information security 
program been evaluated for cost effectiveness? 

(If so, explain.) No - for security. 
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7. Is manual processing of, data a practical 
alternative in times of ADP computer 
system outages? ^°* 


«. How many members of the security staff have had 

formal training in computer science? How many are 
qualified to operate a terminal to make inputs and 
retrieve information? 

> 


All of the Information Systems Security Group. 

All of the Information Systems Security Group. 

Numerous others in additional units have been trained 
and are qualified. 


9. What problems have you encountered in application of 
ADP to the information security program (management 

and operational)? Lack of adequate resources for size of job. 


10. What benefits have you encountered in application of ADP 

> to operation and management of the information security 
program, i.e. decreased costs, decreased personnel staff, 

improved controls, etc,? Improved controls. 


* 11 . 


Would you recommend use of computers to agencies with 

limited information security programs? (Costs vs. benefits?) ^ . &udit trail . abso i ute must. 
If so. in what areas; 
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